In the Linux kernel, the following vulnerability has been resolved: bonding: fix the program leak when XDP is replaced We need to release the… (CVE-2026-98966)

The Linux kernel bonding driver had a vulnerability where the BPF program reference was not properly released when the XDP program was replaced or removed, causing a program leak. This flaw was identified during AI-driven testing for propagation series, revealing accumulation of leaked programs. The fix ensures that the reference to the old BPF program is released correctly in all cases, preventing resource leaks. A selftest to prevent conflicts will be introduced in the net-next kernel series.

The vulnerability causes resource leakage in the Linux kernel bonding driver when XDP programs are replaced or removed. While no direct exploitation or active attacks are reported, the leak could lead to resource exhaustion over time, potentially affecting system stability or performance.

A fix for this vulnerability has been implemented in the Linux kernel. Users should update to the kernel version that includes this fix once it is released. Additionally, a selftest will be added in future kernel releases to prevent regression. Until then, monitoring kernel updates and applying them promptly is recommended.